What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Soon I Wont Be Able To Ask For Help

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
PLEASE HELP

BELOW is the text of the Problem with popups prompting the following
> connections and redirections, I close one and in a short while another opens; I just cant find and delete the files causing it:
>
>
> res://C:\WINDOWS\SYSTEM\SHDOCLC.DLL/offcancl.htm#http:
> //www.insurancedeal.net/show.php
> or
> res://C:\WINDOWS\SYSTEM\SHDOCLC.DLL/offcancl.htm#http:
> //www.findspyware.net/show.php
>
> Also one during on line work to do with Strip Poker: www.girlsforgames.com?
>
> ALSO window prompting that Windows Security Centre Firewall has found
> problems and "Do I want to go on line to download spyware solutions".
>
>
>
>
> I don't have a firewall (Maybe I should have!) and when I click on YES, I
> go to a page which says "Download one of the following"; and below is a
> list of numbers 1 through 10 but no options next to the numbers. There
> are no buttons on the Internet Explorer window on these occasions (only),
> and so I close the window.
>
> I have run Spybot,
> Logfile of HijackThis v1.98.2
> Scan saved at 6:35:19 PM, on 2/01/05
> Platform: Windows 98 SE (Win9x 4.10.2222A)
> MSIE: Internet Explorer v5.50 (5.50.4134.0600)
>
> Running processes:
> C:\WINDOWS\SYSTEM\KERNEL32.DLL
> C:\WINDOWS\SYSTEM\MSGSRV32.EXE
> C:\WINDOWS\SYSTEM\SPOOL32.EXE
> C:\WINDOWS\SYSTEM\MPREXE.EXE
> C:\WINDOWS\SYSTEM\MSTASK.EXE
> C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINJECT.EXE
> C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
> C:\WINDOWS\SYSTEM\mmtask.tsk
> C:\WINDOWS\EXPLORER.EXE
> C:\WINDOWS\PTSNOOP.EXE
> C:\WINDOWS\SYSTEM\CMMPU.EXE
> C:\WINDOWS\TASKMON.EXE
> C:\WINDOWS\SYSTEM\SYSTRAY.EXE
> C:\PROGRAM FILES\PCI AUDIO APPLICATIONS\MIXER.EXE
> C:\PROGRAM FILES\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
> C:\WINDOWS\SYSTEM\STIMON.EXE
> C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
> C:\WINDOWS\LOADQM.EXE
> C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
> C:\PROGRAM FILES\U-STORAGE TOOLS2.1\USTORAGE.EXE
> C:\WINDOWS\SYSTEM\IPCFG.EXE
> C:\WINDOWS\SYSTEM\SCANDS32.EXE
> C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
> C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
> C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
> C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
> C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
> C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINSM32.EXE
> C:\WINDOWS\SYSTEM\WMIEXE.EXE
> C:\PROGRAM FILES\CLEARLYBOOKKEEPING\QUICKBOOKS
> PRO\COMPONENTS\QBAGENT\QBDAGENT2002.EXE
> C:\PROGRAM FILES\DELRINA\WINFAX\FAXMNG32.EXE
> C:\Program Files\Norton CleanSweep\Monwow.exe
> C:\PROGRAM FILES\DELRINA\WINFAX\WFXMOD32.EXE
> C:\WINDOWS\SYSTEM\TAPISRV.EXE
> C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
> C:\WINDOWS\PROFILES\STEVE\DESKTOP\HIJACK\HIJACKTHIS.EXE
>
> R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) =
> http://fastsearchweb.com/srh.php?q=%s
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> www.connectfree.co.uk
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> about:blank
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.connectfree.co.uk/
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
> about:blank
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.connectfree.co.uk/
> R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =
> about:blank
> R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
> about:blank
> R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
> about:blank
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
> F1 - win.ini: load=ptsnoop.exe
> F1 - win.ini: run=C:\WINDOWS\SYSTEM\cmmpu.exe
> N1 - Netscape 4: user_pref("browser.startup.homepage",
> "http://www.symantec.com"); (C:\Program
> Files\Netscape\Users\sm_jones\prefs.js)
> O1 - Hosts: 207.68.176.190 www.auto.search.msn.com
> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
> C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
> O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
> C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
> O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
> O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
> O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
> O4 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio
> Applications\Mixer.exe /startup
> O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE
> /h
> O4 - HKLM\..\Run: [RegisterDropHandler]
> C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
> O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
> O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
> O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
> O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD
> Creator 5\DirectCD\DirectCD.exe"
> O4 - HKLM\..\Run: [LoadQM] loadqm.exe
> O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
> powrprof.dll,LoadCurrentPwrScheme
> O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
> /LOADQUIET
> O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP
> STOPPER\DPPS2.EXE"
> O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage
> tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
> O4 - HKLM\..\Run: [ipcfg.exe] C:\WINDOWS\SYSTEM\IPCFG.EXE
> O4 - HKLM\..\Run: [scands32.exe] C:\WINDOWS\SYSTEM\SCANDS32.EXE
> O4 - HKLM\..\Run: [InpriseMon] control64.exe
> O4 - HKLM\..\Run: [ParisM] vxdman.exe
> O4 - HKLM\..\Run: [CreateCD50]
> C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
> O4 - HKLM\..\RunServices: [RegisterDropHandler]
> C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
> O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
> powrprof.dll,LoadCurrentPwrScheme
> O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
> O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton
> CleanSweep\CSINJECT.EXE
> O4 - HKLM\..\RunOnce: [STREAMIP0] "C:\Program Files\Norton
> CleanSweep\csinsm32.exe" -s "C:\Program Files\Norton
> CleanSweep\IM006783.CIL" rundll32.exe streamci,StreamingDeviceSetup
> {D84D449B-62FB-4ebb-B969-5183ED3DFB51},GLOBAL,{71985F4A-1CA1-11d3-9CC8-00C04F7971E0},C:\WINDOWS\INF\streamip.inf,BDAcodec
> O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"
> /background
> O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
> O4 - HKCU\..\Run: [keybdll] StartCpl.exe
> O4 - HKCU\..\Run: [nmdllw] ms-its.exe
> O4 - HKCU\..\Run: [systemdll] atl_helper.exe
> O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
> O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft
> Office\Office\OSA.EXE
> O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft
> Office\Office\FINDFAST.EXE
> O4 - Startup: Forget Me Not Reminders.lnk = C:\CACARD\FMREMIND.EXE
> O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program
> Files\Norton CleanSweep\csinsm32.exe
> O4 - Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program
> Files\clearlybookkeeping\QuickBooks
> Pro\Components\QBAgent\qbdagent2002.exe
> O4 - Startup: WinFax PRO 7.5.lnk = C:\Program
> Files\Delrina\WinFax\faxmng32.exe
> O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
> O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
> O12 - Plugin for .swf: C:\PROGRAM
> FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
> O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
> O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
> O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) -
> http://www2.incredimail.com/contents/setup…er/imloader.cab
> O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
> http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
> O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient
> Class) -
> http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
> O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -
> http://messenger.zone.msn.com/binary/Chess.cab31267.cab
> O21 - SSODL: jzpCFjcvG - {2A2014E5-808A-BE4F-59A8-EDDA5EA60D44} -
> C:\WINDOWS\SYSTEM\ULID.DLL
>
>
>
> Any help you can offer me would make me very grateful.
>
> Steve Jones
Post #2
Hello jonestev , welcome to the TC.

This is what I suggest you do.

Download CWShredder from my signature below. Unzip it on the desktop.
Open CWShredder and with ALL other windows closed, click fix.


Go here and run online scans (all), allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #3
Hi friend,

Many thanks for the help and any further advice appreciated… :wavey:

I followed your notes - except that I couldn’t download the files from the internet for the virus scan - I did run a Norton Virus scan though (which produced nothing).

Then in the following order I ran and found…

The CWShredder found nothing
SpyBot Found 4 items it dealt with in the registry
Including DSO exploits:…internetsettings\zones\0\1004!=w=3 and XerOx Local_Machine\software\XerOx
Spyware Blaster found 1 item
SpySweeper found 36 items and a further 68 suspects (most impressed with this one and bought it)
AdAware found nearly 90 items to deal with, but took hours to complete!

HOW THE SYSTEM IS WORKING

Generally usable, lots faster on the Internet (dial-up) than it was and I can now get to sites I previously couldn’t.

I am still getting this blank page appear intermittently with the address in the title bar directing (in this case to findspyware) to www.insurancedeal.net. As well as the VB box appearing telling me Windows Security Centre Firewall (don’t have one - remember) is wanting me to go online and find a solution to some problem it’s discovered. (This ends up at a bogus page if I go on line)

I tried to discover the properties of the page and they seem to point to a DLL file in C:windows\system\shdoclc.dll None of the searches indicate this file so I have been reluctant to delete it (not knowing what it does)



HIJACK LOG as follows:

Logfile of HijackThis v1.98.2
Scan saved at 9:41:40 AM, on 8/01/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PCI AUDIO APPLICATIONS\MIXER.EXE
C:\PROGRAM FILES\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\PROGRAM FILES\U-STORAGE TOOLS2.1\USTORAGE.EXE
C:\WINDOWS\SYSTEM\IPCFG.EXE
C:\WINDOWS\SYSTEM\SCANDS32.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINSM32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\CLEARLYBOOKKEEPING\QUICKBOOKS PRO\COMPONENTS\QBAGENT\QBDAGENT2002.EXE
C:\PROGRAM FILES\DELRINA\WINFAX\FAXMNG32.EXE
C:\Program Files\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\DELRINA\WINFAX\WFXMOD32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\PROFILES\STEVE\DESKTOP\HIJACK\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.connectfree.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.connectfree.co.uk/1024768.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.connectfree.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.symantec.com"); (C:\Program Files\Netscape\Users\sm_jones\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio Applications\Mixer.exe /startup
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [ipcfg.exe] C:\WINDOWS\SYSTEM\IPCFG.EXE
O4 - HKLM\..\Run: [scands32.exe] C:\WINDOWS\SYSTEM\SCANDS32.EXE
O4 - HKLM\..\Run: [ParisM] vxdman.exe
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunOnce: [STREAMIP0] "C:\Program Files\Norton CleanSweep\csinsm32.exe" -s "C:\Program Files\Norton CleanSweep\IM006783.CIL" rundll32.exe streamci,StreamingDeviceSetup {D84D449B-62FB-4ebb-B969-5183ED3DFB51},GLOBAL,{71985F4A-1CA1-11d3-9CC8-00C04F7971E0},C:\WINDOWS\INF\streamip.inf,BDAcodec
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [keybdll] StartCpl.exe
O4 - HKCU\..\Run: [nmdllw] ms-its.exe
O4 - HKCU\..\Run: [systemdll] atl_helper.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [keybdll] StartCpl.exe
O4 - HKCU\..\RunServices: [nmdllw] ms-its.exe
O4 - HKCU\..\RunServices: [systemdll] atl_helper.exe
O4 - HKCU\..\RunServices: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Forget Me Not Reminders.lnk = C:\CACARD\FMREMIND.EXE
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton CleanSweep\csinsm32.exe
O4 - Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\clearlybookkeeping\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe
O4 - Startup: WinFax PRO 7.5.lnk = C:\Program Files\Delrina\WinFax\faxmng32.exe
O4 - Startup: Spy Sweeper.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O21 - SSODL: jzpCFjcvG - {2A2014E5-808A-BE4F-59A8-EDDA5EA60D44} - C:\WINDOWS\SYSTEM\ULID.DLL
Post #4
Important: Do this before any fix.

New version of HijackThis:

You need to update your version of HijackThis. Open HJT> Config> Misc Tools> Check for update online. If that doesn't work, download it from my signature and remove the hijackThis.exe you have now.

Reboot and "copy/paste" a new log file into this thread..
Post #5
Thanks for that,

I have found new items every time I log on (the family also use the PC and I have run same on each profile that has been active in the last month and found different things in each!!!) Spy Sweeper is still doing a great job of stopping things activate now and then HOWEVER I STILL HAVE THE VB DIALOGUE BOX APPEARING RE. SECURITY CENTER FIREWALL THAT ISN'T THERE, AND THE IE WINDOWS OPENNING (WITHOUT BUTTONS) TO PROMPT ME TO LOG ON AND GO TO "FINDSPYWARE", "INSURANCEDEAL" AND "SEXANDGAMES"

I downloaded and installed the new version of Hijack this and here is the log.

Logfile of HijackThis v1.99.0
Scan saved at 4:02:26 PM, on 10/01/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\IPCFG.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PCI AUDIO APPLICATIONS\MIXER.EXE
C:\PROGRAM FILES\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\PROGRAM FILES\U-STORAGE TOOLS2.1\USTORAGE.EXE
C:\WINDOWS\SYSTEM\SCANDS32.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINSM32.EXE
C:\PROGRAM FILES\CLEARLYBOOKKEEPING\QUICKBOOKS PRO\COMPONENTS\QBAGENT\QBDAGENT2002.EXE
C:\PROGRAM FILES\DELRINA\WINFAX\FAXMNG32.EXE
C:\Program Files\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\DELRINA\WINFAX\WFXMOD32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\PROFILES\STEVE\DESKTOP\HIJACK\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.connectfree.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.connectfree.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.connectfree.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.symantec.com"); (C:\Program Files\Netscape\Users\sm_jones\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio Applications\Mixer.exe /startup
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [ipcfg.exe] C:\WINDOWS\SYSTEM\IPCFG.EXE
O4 - HKLM\..\Run: [scands32.exe] C:\WINDOWS\SYSTEM\SCANDS32.EXE
O4 - HKLM\..\Run: [ParisM] vxdman.exe
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunOnce: [STREAMIP0] "C:\Program Files\Norton CleanSweep\csinsm32.exe" -s "C:\Program Files\Norton CleanSweep\IM006783.CIL" rundll32.exe streamci,StreamingDeviceSetup {D84D449B-62FB-4ebb-B969-5183ED3DFB51},GLOBAL,{71985F4A-1CA1-11d3-9CC8-00C04F7971E0},C:\WINDOWS\INF\streamip.inf,BDAcodec
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [keybdll] StartCpl.exe
O4 - HKCU\..\Run: [nmdllw] ms-its.exe
O4 - HKCU\..\Run: [systemdll] atl_helper.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [keybdll] StartCpl.exe
O4 - HKCU\..\RunServices: [nmdllw] ms-its.exe
O4 - HKCU\..\RunServices: [systemdll] atl_helper.exe
O4 - HKCU\..\RunServices: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Forget Me Not Reminders.lnk = C:\CACARD\FMREMIND.EXE
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton CleanSweep\csinsm32.exe
O4 - Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\clearlybookkeeping\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe
O4 - Startup: WinFax PRO 7.5.lnk = C:\Program Files\Delrina\WinFax\faxmng32.exe
O4 - Startup: Spy Sweeper.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O21 - SSODL: jzpCFjcvG - {2A2014E5-808A-BE4F-59A8-EDDA5EA60D44} - C:\WINDOWS\SYSTEM\ULID.DLL


MANY THANKS FOR YOUR FURTHER HELP AND HELP SO FAR.

BLESSINGS
STEVE
Post #6
SpySweeper

I suggest you do this:

Run Hijack This again and put a check by these.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ipcfg.exe] C:\WINDOWS\SYSTEM\IPCFG.EXE
O4 - HKLM\..\Run: [scands32.exe] C:\WINDOWS\SYSTEM\SCANDS32.EXE
O4 - HKLM\..\Run: [ParisM] vxdman.exe
O4 - HKCU\..\Run: [keybdll] StartCpl.exe
O4 - HKCU\..\Run: [nmdllw] ms-its.exe
O4 - HKCU\..\Run: [systemdll] atl_helper.exe
O4 - HKCU\..\RunServices: [keybdll] StartCpl.exe
O4 - HKCU\..\RunServices: [nmdllw] ms-its.exe
O4 - HKCU\..\RunServices: [systemdll] atl_helper.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O21 - SSODL: jzpCFjcvG - {2A2014E5-808A-BE4F-59A8-EDDA5EA60D44} - C:\WINDOWS\SYSTEM\ULID.DLL

Close ALL windows and browsers except HijackThis and click "Fix checked"



Restart your computer in Safe Mode.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.



Search for and delete these files if still listed.

vxdman.exe
StartCpl.exe
ms-its.exe
atl_helper.exe
C:\WINDOWS\SYSTEM\IPCFG.EXE



1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Post #7
Hi LDTate,

Thanks again for all your help and for the directions…

I ran Adaware again 3 times and got rid of another 16 items before following your advice and checked the Hijackthis items you list. On re-boot Default_Search=about:blank was back at the beggining and windows\system\ulid.dll (which I guess is the system resetting / inventing these?)

I only had to find and delete IPCFG.EXE

On reboot got a fatal exception error OE at 0028:C148FIE9 in VAD CDRALVSD (01) + 00002009 and application terminated. Hitting F5 restored the desktop!

Cleared the files again and Ad-Aware scanned again for good measure and caught 3 hijack attempts and 3 browser attacks and a trojan. ALL SORTED!

Since then all seems to be fine - I have not been using the PC much though and time will tell.

Here is the new Hijack this log:

Logfile of HijackThis v1.99.0
Scan saved at 5:29:06 PM, on 11/01/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PCI AUDIO APPLICATIONS\MIXER.EXE
C:\PROGRAM FILES\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\PROGRAM FILES\U-STORAGE TOOLS2.1\USTORAGE.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINSM32.EXE
C:\PROGRAM FILES\CLEARLYBOOKKEEPING\QUICKBOOKS PRO\COMPONENTS\QBAGENT\QBDAGENT2002.EXE
C:\PROGRAM FILES\DELRINA\WINFAX\FAXMNG32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\Program Files\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\DELRINA\WINFAX\WFXMOD32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\PROFILES\STEVE\DESKTOP\HIJACK\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.connectfree.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.connectfree.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.connectfree.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.symantec.com"); (C:\Program Files\Netscape\Users\sm_jones\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio Applications\Mixer.exe /startup
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunOnce: [STREAMIP0] "C:\Program Files\Norton CleanSweep\csinsm32.exe" -s "C:\Program Files\Norton CleanSweep\IM006783.CIL" rundll32.exe streamci,StreamingDeviceSetup {D84D449B-62FB-4ebb-B969-5183ED3DFB51},GLOBAL,{71985F4A-1CA1-11d3-9CC8-00C04F7971E0},C:\WINDOWS\INF\streamip.inf,BDAcodec
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - Startup: Forget Me Not Reminders.lnk = C:\CACARD\FMREMIND.EXE
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton CleanSweep\csinsm32.exe
O4 - Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\clearlybookkeeping\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe
O4 - Startup: WinFax PRO 7.5.lnk = C:\Program Files\Delrina\WinFax\faxmng32.exe
O4 - Startup: Spy Sweeper.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O21 - SSODL: jzpCFjcvG - {2A2014E5-808A-BE4F-59A8-EDDA5EA60D44} - C:\WINDOWS\SYSTEM\ULID.DLL

Blessyou

Steve
Post #8
I suggest you do this:


Restart your computer in Safe Mode.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.



Run Hijack This again and put a check by these.

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

O21 - SSODL: jzpCFjcvG - {2A2014E5-808A-BE4F-59A8-EDDA5EA60D44} - C:\WINDOWS\SYSTEM\ULID.DLL

Close ALL windows and browsers except HijackThis and click "Fix checked"



1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Post #9
Hi LDTate

Thanks agan for the excellent answers to PC's hideous problems!

Followed your directions and got rid of the last item, its been up and running for a while now without pop interuptions (I have had the antipopup active though) that over rode everything. Here is the latest Hijackthis log:

Logfile of HijackThis v1.99.0
Scan saved at 4:07:25 PM, on 12/01/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PCI AUDIO APPLICATIONS\MIXER.EXE
C:\PROGRAM FILES\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\PROGRAM FILES\U-STORAGE TOOLS2.1\USTORAGE.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\NORTON CLEANSWEEP\CSINSM32.EXE
C:\PROGRAM FILES\CLEARLYBOOKKEEPING\QUICKBOOKS PRO\COMPONENTS\QBAGENT\QBDAGENT2002.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\DELRINA\WINFAX\FAXMNG32.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\Program Files\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\DELRINA\WINFAX\WFXMOD32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\PROFILES\STEVE\DESKTOP\HIJACK\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.connectfree.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.connectfree.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.connectfree.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.symantec.com"); (C:\Program Files\Netscape\Users\sm_jones\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio Applications\Mixer.exe /startup
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunOnce: [STREAMIP0] "C:\Program Files\Norton CleanSweep\csinsm32.exe" -s "C:\Program Files\Norton CleanSweep\IM006783.CIL" rundll32.exe streamci,StreamingDeviceSetup {D84D449B-62FB-4ebb-B969-5183ED3DFB51},GLOBAL,{71985F4A-1CA1-11d3-9CC8-00C04F7971E0},C:\WINDOWS\INF\streamip.inf,BDAcodec
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - Startup: Forget Me Not Reminders.lnk = C:\CACARD\FMREMIND.EXE
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton CleanSweep\csinsm32.exe
O4 - Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\clearlybookkeeping\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe
O4 - Startup: WinFax PRO 7.5.lnk = C:\Program Files\Delrina\WinFax\faxmng32.exe
O4 - Startup: Spy Sweeper.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab


What do you think?

Steve :D
Post #10
Good Job :thumbup:

Don't forget to visit windows updates ;)

Log looks good :D :thumbup: How is it running any issues?

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D
Post #11
Thanks again :P I've downloaded the AVG and Zone Alarm and will install them tonight. No probs at present. This has been a real experience and a pleasure having such help. Tell me how does one lern more (esp. about the HiJackThis log), and help others? There seemed to be so very many requests and I suspect fewer to meet the need than there could be. A very warm Australian Happy New Year to you - you have made mine! Blessings on you Steve
Post #13
Glad we could help.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for e-mail)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI